In my last entry I shared with you how to use WMI in Vbscript to reboot a server from a scheduled job (either locally or remotely) and I hinted at a scenario where I needed to use this script because a server had a memory leak in an application (Trend Micro OfficeScan 8.0, to be exact). They’ve got a fix out but we just upgraded to 8.0 and apparently that didn’t go well, plus this patch is a server patch that immediately rolls out to the clients– so they are less than willing to jump onto the razor’s edge with a patch. (Politics– We’ve all been there, right?)
Well, in this entry I’m going to share the function I wrote to pull Poolmemory Non-Paged Bytes from the server using Win32_PerfFormattedData_PerfOS_Memory. I’ll not go into detail about this class and its functions and members here in this posting, but you can find out more details at Microsoft’s MSDN site here. Remember from a previous post (Determining properties and methods used in a WMI object for use in a vbscript), that you can always find out what properties are available by looking at the class definition of these pages.
The function I wrote pulls the PoolnonpagedBytes property from the Win32_PerfFormattedData_PerfOS_Memory object. This function requires you to pass it the last value of the performance counter. While it doesn’t use it to get the data it does internal to the function compute the delta of the last and the new value– which is handy if your logging and/or monitoring in real time troubleshooting.
The following is a function only, not a complete vbscript to save space and to focus in on this part of the code. For a complete working example script that is tehone I’ve been talking about in the last two posts go here that combines the previous posting’s reboot function, this function, and takes into account the number of times a value can exceed a threshhold during a time frame look here in the vbscript section for “non-paged pool memory“.
For Each detail In oRef
Newval = detail.PoolNonpagedBytes
WScript.Echo Newval & vbtab & Newval-last
getmem = (Newval/1024)/1024
Obviously, you have to do some work before you call the function setting up both a variable to recieve the return and also some sort of variable to keep track of the last value. If you aren’t after tracking the changes and only want the return value you can pass any number, including zero, to the fuction and remove the wscript.echo lines in the above code snippet.
Also, since it’s a snippet and as I write this I noticed that you will need some setup in the main routine like:
- a variable in your main script called strSrv that has the name of the server you want to pull the value of the counter.
- The following line in the main routine that sets up the “SQL” call for WMI and initializes the value of strQuery. (Btw, for a good back to basics look at SQL calls, check out the SQL Server with Mr. Denny Blog here on ITKE.)
strQuery=”SELECT * From Win32_PerfFormattedData_PerfOS_Memory”
You can find more performance monitor classes that are available to you here. Basically, if it’s available in perfmon– you can get it with vbscript! Just look for classes named like Win32_PerfFormattedData…. or Win32_PerfRawData…, these classes will get you what you want. Keep in mind that Raw data is just that and most times you are going to want to get PrefFormatted data in the beginning. If you’d like more information on the differences, post a comment and I’ll come back to it later.
As always, this code works perfectly. However, sometimes the formatting of the blog breaks the code if you copy and paste it into your editor. So, if you’d like to not type or troubleshoot any syntax errors due to the copy and paste problems– I’ve provided the code for download, plus example output files from my final tests for you. You’ll find the code and other files available for download from my website’s (www.websystemsadministration.com) File Depot under the ITKE Blog Scripts category. Enjoy and happy scripting!
Extra credit: This is double extra credit, I guess, in my last entry I gave you a hint at my last extra credit question in my previous post– I just made the call a different way. The last posting asked you about what this part of the code did:
Does this help give you more information to go on?